Security grounded in actual controls.

Report a concern privately

Email contact@tallguytechnologies.com with the affected app or page, a description and safe reproduction steps. Start with a redacted summary. Do not include credentials, live customer records or sensitive exploit material in the initial email.

Responsible testing

Use only accounts and data you are authorized to test. Do not disrupt services or access another customer’s information. Contact us to coordinate further details. We do not offer a bug bounty or grant permission to test third-party systems.

Product boundaries

Most TGT apps run entirely inside Zendesk. Apps that use the TGT app service connect only after a Zendesk administrator approves access on Zendesk’s own authorization screen, with a separate OAuth client per app and only the permissions that app needs. The service encrypts tokens and keys at rest, keeps them in an isolated component with its own encryption key that only the service can reach, verifies Zendesk’s signature on every webhook and app request, rate-limits requests, and deletes an account’s data when the app is disconnected or uninstalled. Actual permissions and data paths vary by app and are described in its documentation. We do not claim SOC 2 certification, a guaranteed absence of vulnerabilities or an absolute security guarantee.

Handling reports and incidents

We assess reports, investigate potential impact and coordinate appropriate fixes. Required notifications follow applicable law and contractual obligations. No fixed response-time commitment is offered by this page.

For personal-information requests, see the Privacy Policy.